Browse Source

avcodec/wavpack: Check L/R values before use to avoid harmless integer overflow and undefined behavior in fate

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 042260cde4)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.4.10
Michael Niedermayer 10 years ago
parent
commit
3126d6ee02
1 changed files with 8 additions and 0 deletions
  1. +8
    -0
      libavcodec/wavpack.c

+ 8
- 0
libavcodec/wavpack.c View File

@@ -472,6 +472,14 @@ static inline int wv_unpack_stereo(WavpackFrameContext *s, GetBitContext *gb,
s->decorr[i].samplesB[0] = L;
}
}

if (type == AV_SAMPLE_FMT_S16P) {
if (FFABS(L) + FFABS(R) > (1<<19)) {
av_log(s->avctx, AV_LOG_ERROR, "sample %d %d too large\n", L, R);
return AVERROR_INVALIDDATA;
}
}

pos = (pos + 1) & 7;
if (s->joint)
L += (R -= (L >> 1));


Loading…
Cancel
Save